The protection of your personal data is a top priority for us. Ourli is a household organizer that lets you share a pantry, shopping lists, tasks and a calendar with the members of your household. To sync this data between devices and members, Ourli uses an account and a server. All household content is end-to-end encrypted on your device with keys that only you and the members of your household hold. We store it only in encrypted form and cannot read it. This policy explains which data we can see and why.
To use Ourli you sign in with your email address, either with a one-time code or link sent by email or with a password. Where offered, you can also sign in with your Google account; Google then shares your email address and an identity token with us. We process the following account data:
Your sign-in session is stored on your device, encrypted with a key held by the Android Keystore.
Pantry items, shopping lists, tasks, calendar events and household names are encrypted on your device (AES-256-GCM) before they are uploaded. The household key is shared with each member individually, encrypted to that member's public key (X25519). We never receive these keys and therefore cannot decrypt your household content.
To sync the encrypted records, our server stores technical metadata that is not encrypted: record IDs and record type (e.g. pantry item, task or event), the household a record belongs to, which account created or last changed it, timestamps, the size of the encrypted record, and the key version used.
When you set up Ourli, a key pair is created on your device. We store your public key, so other members can share household keys with you, and a copy of your private key encrypted with your recovery key, so you can restore access on a new device. The recovery key is shown to you once and is never sent to us. On your device, the private key is protected by the Android Keystore.
Because we never have your keys, we cannot recover your household content if you lose your recovery key and all of your signed-in devices.
Owners can invite others with a QR code, a code or a link. An invite contains a secret that is never sent to us; the server stores only the invite ID, the household's keys encrypted with that secret, who created and accepted the invite, and when it expires. If you share an invite through another app (e.g. a messenger), that app's privacy policy applies. Invites expire after 7 days by default and are deleted from our server 30 days after they expire.
Ourli keeps an encrypted copy of your household records and pending changes on your device so it works offline. Records are decrypted only in memory while the app is in use. The app also stores your settings (such as theme, reminder times and the app lock setting) and the household you last opened. This data is excluded from Android cloud backup and device-to-device transfer. Signing out locks your keys on the device; deleting your account removes them and the local copy of your records. Uninstalling the app or clearing its data removes all of it.
The camera is used to scan product barcodes, best-before dates and invite QR codes. Scanning uses Google ML Kit, which processes the camera images entirely on your device. Images are never uploaded to us or to Google. The ML Kit library may send device and app details and operational metrics (such as processing time, events and errors) to Google for diagnostics when internet access is available. See the ML Kit Terms and the ML Kit data disclosure for details.
When you scan a product barcode, Ourli can look up the product name, brand and quantity on Open Food Facts, a public food product database. Only the barcode number is sent; as with any internet request, Open Food Facts also receives your IP address. This lookup is enabled by default and can be turned off at any time in Settings under "Online product lookup". Please refer to the Open Food Facts privacy policy.
Reminders (morning summary, expiry alerts, task and event reminders) are created on your device from your decrypted data. They are not sent through our server or a push service, and their content is hidden on the lock screen.
If you turn on the optional app lock, Ourli asks for your fingerprint, face or device PIN using Android's biometric prompt and hides its content from screenshots and the recent apps view. Biometric data is handled by Android and never accessible to Ourli.
Ourli is free for one person. To share a household with others, the owner can subscribe to Ourli Family through Google Play Billing. Payment is processed entirely by Google; we do not receive your payment details. The app passes a pseudonymous account identifier (a one-way hash of your user ID) and the household ID to Google Play with the purchase.
To grant access securely, our server verifies the purchase with Google Play and stores the purchase token, the subscribed product (household size), the subscription state, expiry date and auto-renewal status, linked to the household and the purchasing account. Google Play also notifies our server about renewals and cancellations. Please refer to the Google Privacy Policy for information about how Google handles purchase data.
If you email us, we use your email address and the content of your message to answer you. Emails to our @hblsoftware.com addresses are forwarded by Cloudflare (Cloudflare, Inc., USA) to our mailbox at Proton (Proton AG, Switzerland), where they are stored. We delete support emails once your request is resolved, unless we have to keep them for legal reasons.
We do not sell your personal data and do not share it for advertising.
Ourli does not request access to your contacts, location, microphone or photo library. The app uses the following permissions:
When you export your data, you choose where to save the file using the Android file picker. Ourli does not need storage permissions for this.
We do not use any analytics tools (such as Google Analytics or Firebase), crash reporting services, or advertising networks that could track your user behavior. The Google ML Kit library described above may still process operational diagnostics.
This website is hosted on GitHub Pages (GitHub, Inc., USA). When you visit it, GitHub processes your IP address to deliver the pages and to keep the service secure. The website does not use cookies, analytics or tracking. See the GitHub Privacy Statement.
When downloading the app, information is transmitted to the respective app store (e.g., Google Play Store). We have no influence over this data collection and are not responsible for it. Please refer to the privacy policy of the respective store operator.
We process your account data, the encrypted household data and its metadata, and subscription data to provide the Ourli service you have signed up for (Art. 6(1)(b) GDPR). Server logs, website access data and support emails are processed based on our legitimate interest in operating a secure and reliable service and in answering your requests (Art. 6(1)(f) GDPR). The online product lookup and the optional Google sign-in are used only if you choose them.
Ourli can be used by families. Accounts should be created by, or with the consent of, a parent or guardian where required by law.
Under the GDPR, you have the right to access, rectify, delete and export your personal data, to restrict or object to its processing, and to lodge a complaint with a data protection supervisory authority. You can exercise many of these rights directly in the app: change your display name, export a decrypted copy of your household data in Settings → Export household data, and delete your account. Since we cannot read your household content, we can only provide it in encrypted form. For anything else, please contact us at the email address provided above.
We may update this privacy policy when the app changes. We will announce material changes in the app.
See also: Terms of Use · Help